CompTIA Network+ Domain 1: Networking Concepts

6 host bits → 2⁶−2 = 62 usable hosts. The smallest block that still fits 50, so it wastes the least.

• AGives 2⁷−2 = 126 usable hosts. It works, but wastes more than half the addresses — not the tightest fit.
• C5 host bits → 2⁵−2 = 30 usable. Fewer than the 50 required, so it fails the requirement.
• D254 usable hosts — the whole network as one subnet. Far more than needed, wastes the most.

TCP provides connection-oriented, reliable segment delivery with ports — the defining job of Layer 4.

• ALayer 2 handles framing and MAC addressing (e.g. Ethernet switches), not end-to-end segment delivery.
• BLayer 3 is IP routing and logical addressing. TCP rides on top of IP — it is not the network layer.
• DLayer 7 is where HTTP and DNS live. They USE TCP, but TCP itself is one layer below.

SSH encrypts the entire session and is the standard for secure remote CLI access on TCP 22.

• BTelnet gives a remote CLI but sends everything, including credentials, in cleartext. Never use it for secure access.
• CRDP is a graphical remote-desktop protocol for Windows, not a Linux command-line shell.
• DHTTPS is encrypted web traffic, not an interactive shell. Wrong protocol for CLI access.

Routers use logical IP addresses to forward packets between networks — the role of Layer 3.

• AForwarding by MAC address at Layer 2 describes a switch, not a router.
• CPort numbers belong to the Transport layer (TCP/UDP). Routers don't forward based on ports.
• DLayer 7 is application protocols. A router doesn't read application data to forward packets.

An A (Address) record maps a hostname to a 32-bit IPv4 address.

• BAAAA maps a hostname to an IPv6 address, not IPv4. Easy to confuse — note the four A's.
• CMX identifies the mail server for a domain, not a host's IP address.
• DCNAME is an alias pointing one name to another name, not directly to an IP.

UDP skips handshakes and retransmission, giving the low latency real-time media needs. A dropped packet is better than a late one.

• ATCP's retransmissions and acknowledgements add delay, which hurts real-time voice. Reliability isn't worth the latency here.
• CICMP is for diagnostics and error messages (ping), not for carrying application data streams.
• DARP resolves IP-to-MAC on the local link. It isn't a transport protocol for application traffic.

172.16.0.0–172.31.255.255 (172.16.0.0/12) is a private range reserved by RFC 1918.

• AThis is a public, internet-routable address (a well-known public DNS resolver), not RFC 1918 private space.
• C169.254.0.0/16 is link-local (APIPA — Microsoft's name for the RFC 3927 mechanism), self-assigned when DHCP fails. Reserved, but not RFC 1918 private.
• DThis falls in public, internet-routable space, not a private range.

Logical (IP) addressing and subnet membership decisions occur at the network layer, so a host rejecting a mismatched logical address drops it at Layer 3.

• AThe data link layer already succeeded here because frames arrived with valid MAC addresses and passing CRCs, so the frame check was clean.
• CThe transport layer manages ports, segmentation, and reliability such as TCP sequencing, not the logical network address that determines subnet membership.
• DThe application layer handles user-facing protocol data and would never see the packet because the host already discarded it lower in the stack.

A load balancer is designed to spread incoming client sessions across a backend pool using methods like round robin or least connections, scaling capacity.

• AA forward proxy brokers and filters outbound requests on behalf of internal clients, so it does not spread inbound user sessions across a server pool.
• BAn IPS inspects traffic inline and blocks malicious patterns, but it does not allocate legitimate connections among a group of backend servers.
• DA Layer 2 switch forwards frames within a broadcast domain using MAC tables and has no awareness of server pools or session distribution.

PaaS gives developers a managed runtime and middleware so they deploy only their code while the provider handles the OS and patching beneath it.

• BIaaS provides raw virtual machines and networking, leaving the customer responsible for OS patching and runtime installation that the scenario wants avoided.
• CSaaS delivers a finished application to end users and gives the team no place to deploy their own custom application code.
• DNFV virtualizes network appliances like routers and firewalls as software, which does not describe a managed application development platform.

Syslog uses UDP 514 by default as a connectionless, low-overhead transport that forwards event log messages to a central collector without guaranteed delivery.

• AUDP 161 is used by SNMP for polling and querying device counters, not for receiving forwarded event log messages from network devices.
• BWhile 514 over TCP can carry reliable syslog, the scenario specifies a connectionless UDP transport, which rules out the TCP variant here.
• CUDP 162 receives SNMP traps sent by agents to a manager, which is asynchronous SNMP alerting rather than general syslog event forwarding.

Single-mode fiber's narrow core with a long-reach laser transceiver minimizes modal dispersion and supports 10 Gbps over many kilometers between buildings.

• AMultimode with short-reach optics is engineered for in-building runs of a few hundred meters and cannot reliably span an eight kilometer link.
• CTwisted-pair copper is limited to about 100 meters per segment, so it cannot reach a building eight kilometers away regardless of category.
• DA direct attach copper cable is a short twinax assembly for top-of-rack links measured in meters, not a kilometers-long inter-building run.

In spine-leaf each leaf connects to every spine and never to another leaf, giving consistent two-hop paths ideal for east-west data center traffic.

• AA collapsed core merges the core and distribution into one tier to save cost, but it does not guarantee uniform two-hop paths for east-west fabric traffic.
• BA bus topology shares a single linear backbone medium where all nodes contend, which is obsolete and offers no equal-cost multipath for data center fabrics.
• DA point-to-point link connects exactly two endpoints directly and cannot describe a multi-switch fabric needing uniform paths among many access switches.

SSH on TCP port 22 establishes an encrypted interactive command-line session, protecting the credentials and commands as they cross the untrusted segment exactly as the policy demands.

• ATelnet does provide remote CLI access, but it transmits the login credentials and every command in cleartext, which directly violates the policy requiring encrypted management traffic.
• BHTTP on port 80 reaches a device's web management page rather than its command-line interface, and it sends data unencrypted, so it fails both the CLI and the security requirement.
• CSNMP on UDP 161 is used to monitor and poll device statistics or push limited settings, but it is not an interactive CLI session and older versions transmit community strings in cleartext.

The presentation layer translates data formats and performs encryption and compression, so unreadable content from an untranslated encrypted format is a Layer 6 problem.

• AThe transport layer handles segmentation, port multiplexing, and reliable ordered delivery, all of which the scenario says already worked, so it is not where translation fails.
• BThe session layer establishes, maintains, and tears down dialogues between endpoints, but it does not perform the encryption, compression, or character encoding that this content requires.
• DThe application layer exposes network services to user programs, but the actual reformatting of encrypted or compressed payloads is delegated downward to the presentation layer.

A VPN concentrator is purpose-built to terminate and manage many simultaneous encrypted client tunnels, handling authentication and key exchange for large-scale remote access.

• BA reverse proxy fronts internal servers and brokers inbound client requests to them, but it does not build and terminate encrypted point-to-point VPN tunnels for remote staff.
• CAn IDS passively monitors and alerts on suspicious traffic patterns, so it observes activity rather than establishing or terminating encrypted remote-access connections for users.
• DA content switch makes forwarding decisions based on application-layer data like URLs to steer traffic, which is unrelated to terminating encrypted remote-user tunnels.

A NAT gateway lets private-subnet instances initiate outbound internet connections while translating their addresses, so return traffic flows but unsolicited inbound sessions are blocked.

• AAn internet gateway grants a subnet full bidirectional public connectivity, which would expose the instances to unsolicited inbound traffic that the security requirement explicitly forbids.
• BVPC peering privately links two virtual private clouds to each other, but it provides no path to the public internet for downloading external software updates.
• CA VPN gateway establishes an encrypted tunnel to an on-premises or remote network, which does not give private instances general outbound access to public update servers.

TCP 636 is LDAPS, which wraps directory lookups in TLS to encrypt queries and credentials between the application servers and the directory service.

• ATCP 389 carries standard LDAP, which by default transmits directory queries and credentials without encryption, so it does not satisfy the requirement for TLS protection.
• CTCP 3268 serves global catalog queries across a forest in unencrypted form, so it is not the TLS-protected directory port the administrator needs to open.
• DTCP 88 is used by Kerberos for ticket-based authentication, which is a separate protocol from the TLS-encrypted LDAP directory lookups described here.

A QSFP+ transceiver bundles four 10 Gbps lanes into one quad form factor, delivering 40 Gbps over short multimode runs between top-of-rack switches.

• AAn SFP+ module supports a single 10 Gbps serial lane, so it cannot aggregate the four parallel lanes required to deliver a combined 40 Gbps link.
• BA GBIC is a legacy gigabit interface converter built for 1 Gbps connections, leaving it far below the 40 Gbps throughput this data center upgrade demands.
• DA standard SFP module tops out near 1 Gbps for a single lane, so it falls dramatically short of the 40 Gbps aggregate the design specifies.

Addresses in fe80::/10 are link-local, auto-generated for use only on the directly attached segment and never forwarded by routers off that link.

• BGlobal unicast addresses typically begin in the 2000::/3 range and are routable worldwide, which contradicts the fe80:: prefix and the inability to reach beyond the segment.
• CUnique local addresses fall under fc00::/7 and are routable within and between private sites, so they do not match the fe80:: prefix shown on this interface.
• DIPv6 multicast addresses start with ff00::/8 and deliver to a group of receivers, which does not describe this unicast fe80:: address on a single interface.

VXLAN encapsulates Layer 2 frames inside UDP and uses a 24-bit network identifier, allowing roughly sixteen million segments to stretch across a routed Layer 3 underlay.

• ASD-WAN centrally manages and steers traffic across multiple wide-area transports for branch connectivity, but it does not encapsulate Layer 2 segments to extend them over a routed underlay.
• BZero Trust Architecture is a security model that continuously verifies every access request, so it governs trust decisions rather than transporting stretched Layer 2 segments between sites.
• C802.1Q tagging is itself bound by the 12-bit VLAN ID ceiling of about 4,094 segments and cannot natively carry Layer 2 traffic across a routed Layer 3 underlay.

The data link layer frames data and uses MAC hardware addresses for local delivery, which is exactly how a switch learns ports and forwards frames.

• AThe physical layer deals with bits, voltages, connectors, and signaling on the medium, not with reading hardware addresses to decide where a frame should be forwarded.
• BThe network layer forwards packets using logical IP addresses and routing tables across different networks, but the scenario explicitly says the switch ignores IP addressing entirely.
• DThe transport layer manages port numbers, segmentation, and end-to-end reliability between applications, none of which is involved when a switch forwards frames by hardware address.

A load balancer spreads incoming client requests across a pool of identical servers and uses health checks to remove unresponsive members, preventing any single server from being overwhelmed.

• BA reverse proxy fronts servers and can cache content or terminate TLS for them, but its defining purpose is request brokering and concealment rather than health-checked distribution across a pool.
• CA forward proxy sits in front of internal clients to control and anonymize their outbound requests to the internet, so it does nothing to distribute inbound load across servers.
• DAn intrusion detection system passively inspects traffic and raises alerts on suspicious activity, but it never distributes connections or performs health checks on a back-end server pool.

Rapid elasticity is the automatic provisioning and release of resources to match demand in near real time, letting the retailer pay only for capacity actually used.

• AMultitenancy means multiple customers share the same underlying physical infrastructure while remaining logically isolated, which addresses tenant separation rather than the automatic scaling of capacity with demand.
• BResource pooling describes the provider aggregating compute, storage, and network into a shared pool drawn from by many customers, but it does not by itself add and remove capacity automatically.
• CScalability is the ability to add capacity to handle growth, but it does not inherently include automatically releasing resources when demand falls, which is the defining trait here.

TCP 22 carries SSH, and SFTP runs its file transfer operations inside that single encrypted SSH session, so opening port 22 satisfies the secure transfer requirement.

• ATCP 21 is the FTP control channel that negotiates cleartext file transfers, exactly the insecure service being replaced, so it provides none of the required SSH encryption.
• CUDP 69 is TFTP, a lightweight, unauthenticated, and unencrypted transfer protocol, which is even less secure than FTP and provides no SSH tunneling at all.
• DTCP 990 is used by FTPS in implicit mode, which secures FTP with TLS rather than SSH, so it does not match a transfer carried inside an SSH session.

A spine-leaf fabric connects every leaf to every spine, giving uniform one-hop east-west paths and predictable latency while scaling out by adding more spine switches.

• BThe traditional three-tier core, distribution, and access design optimizes north-south traffic, but server-to-server paths can traverse several hops with variable latency, unlike the uniform fabric described.
• CA collapsed core merges the core and distribution layers into one tier to cut cost in smaller networks, but it does not provide the full leaf-to-spine meshing described.
• DA point-to-point topology directly links exactly two nodes, which cannot describe a multi-switch data center fabric where many leaves connect to many spines.

SLAAC lets a host self-configure by combining an advertised /64 prefix with an EUI-64 identifier built from its MAC using fffe insertion and bit flipping.

• AStateful DHCPv6 hands out full addresses from a server that tracks each lease, but the scenario explicitly states that no DHCP server participates in forming the address.
• BA manual static assignment requires an administrator to type the full address into the interface, which contradicts the host automatically deriving its identifier from its own MAC.
• DAnycast assigns one shared address to multiple nodes so traffic reaches the nearest one, which has nothing to do with a host generating a unique identifier from its MAC.

The control plane decides how traffic should be forwarded and, in SDN, is centralized in the controller that calculates paths and pushes flow entries to switches.

• AThe data plane is the forwarding hardware that moves packets according to installed rules, which in SDN is exactly the function delegated to the switches, not the controller.
• BThe management plane handles administrative tasks like configuration, monitoring, and device access, which is distinct from the real-time forwarding logic the controller computes and distributes.
• CThe application plane hosts network applications that express intent to the controller through northbound APIs, but it does not itself compute and install the forwarding rules.

A /30 yields four total addresses: one network, one broadcast, and exactly two usable hosts, perfectly fitting a point-to-point link.

• AA /28 leaves 14 usable host addresses per subnet, which wastes 12 addresses on a link that only needs two endpoints.
• BA /29 provides six usable host addresses, far more than the two endpoints a point-to-point router link actually requires.
• DA /27 supplies thirty usable host addresses, dramatically over-provisioning a link that connects only two router interfaces.

The session layer establishes, maintains, synchronizes with checkpoints, and terminates the dialogues or sessions between two communicating applications.

• AThe transport layer provides end-to-end delivery and segmentation, but coordinating dialogue setup, checkpoints, and teardown is handled one layer higher.
• CThe presentation layer translates, encrypts, and compresses data formats, but it does not manage the establishment or checkpointing of dialogues.
• DThe application layer provides network services to user processes, while dialogue control and synchronization are the specific job of the session layer.

SMTP uses TCP port 25 for traditional server-to-server mail relay, which is exactly the transfer described in this scenario.

• BPOP3 on port 110 lets a client download and remove mail from a mailbox, not relay messages between mail servers.
• CIMAP on port 143 lets a client read and manage mail stored on a server, not perform server-to-server transfer.
• DPort 587 is the authenticated message submission port used by clients to hand mail to their own server, not for relay.

A CNAME aliases a name to a canonical hostname, so the IP is defined once and all aliases follow it automatically.

• AAn A record maps a name directly to an IPv4 address, so updating the IP would require editing every alias individually.
• BAn MX record designates the mail exchanger for a domain and plays no role in pointing one web hostname to another.
• CA TXT record holds arbitrary text such as SPF data, not a pointer that aliases one hostname to another canonical name.

TCP numbers each byte and expects acknowledgments, so a missing acknowledgment for a sequence range signals loss and triggers retransmission.

• APort numbers identify the sending and receiving applications, but they provide no way to detect that a particular segment went missing.
• CThe checksum detects corruption within a received segment, but it cannot reveal that an entire segment never arrived at all.
• DConnectionless best-effort delivery describes UDP, which performs no retransmission and is the opposite of the reliability TCP provides here.

172.16.200.5 sits within 172.16.0.0 through 172.31.255.255, placing it squarely inside the RFC 1918 private address range.

• AThe private range stops at 172.31.255.255, so 172.32.x addresses fall just outside the block and are publicly routable.
• BThe private 192.168.0.0/16 block ends at 192.168.255.255, so 192.169.x addresses are public, not RFC 1918 private.
• DOnly 10.0.0.0/8 is private in that decade; the 11.0.0.0 network is publicly assigned and not part of RFC 1918.

An inline IPS inspects traffic and can actively block or drop malicious packets in real time, exactly matching the described preventive role.

• BAn IDS typically monitors passively and raises alerts on suspicious traffic, but it does not sit inline to drop the packets itself.
• CA network tap copies traffic for monitoring tools to observe, providing visibility only and never blocking or modifying the live flow.
• DA SIEM aggregates and correlates logs for analysis after the fact; it does not inspect or drop packets in the live data path.

A dedicated direct interconnect is a private physical circuit to the provider, bypassing the public internet for predictable latency and bandwidth.

• AAn IPsec VPN encrypts traffic but still rides the public internet, so its latency and bandwidth remain subject to internet congestion.
• BA client VPN connects individual remote users over the internet and does not provide a dedicated circuit between data centers and cloud.
• CA NAT gateway lets private cloud instances reach the internet outbound; it is not a private link from on-premises to the provider.

Category 6a is engineered to support 10GBASE-T across the full 100-meter run with reduced alien crosstalk, meeting every stated requirement.

• ACategory 5e is rated for 1000BASE-T and cannot reliably carry 10 Gbps, so it fails the 10GBASE-T speed requirement entirely.
• CCategory 6 can carry 10GBASE-T only over a reduced distance (roughly 37–55 meters depending on alien-crosstalk mitigation), so it cannot guarantee 10 Gbps across the full 100-meter distance.
• DCategory 3 was designed for 10 Mbps and voice wiring, making it far too slow for any 10 Gigabit Ethernet application.

In spine-and-leaf every leaf connects to every spine and never to another leaf, so each leaf-to-leaf path is a consistent two hops and capacity scales by adding spines.

• AA collapsed-core/hierarchical design layers core, distribution, and access switches; it does not give every access switch a direct link to every backbone switch.
• BA bus topology shares a single backbone cable among all hosts, which is the opposite of the dedicated leaf-to-spine links described here.
• DA ring passes traffic device to device around a closed loop, not through a full set of dedicated leaf-to-spine connections.

Unique local addresses in fc00::/7, commonly written with the fd prefix, provide private internal IPv6 space that is not globally routable.

• BGlobal unicast addresses, typically in 2000::/3, are publicly routable on the internet, the opposite of the private scope required here.
• CLink-local addresses in fe80::/10 work only on a single link and are never routed, so they cannot serve organization-wide internal routing.
• DMulticast addresses in ff00::/8 deliver to groups of interfaces and do not identify individual hosts for private unicast routing.

SD-WAN abstracts multiple transport links under central policy and dynamically steers each application onto the best-performing path, matching every requirement.

• AMPLS is one of the underlying transport circuits being combined, not the overlay that centrally steers applications across multiple links.
• BVXLAN extends Layer 2 segments over a Layer 3 underlay in data centers; it does not perform branch WAN path selection by application.
• CA VPN concentrator terminates many encrypted tunnels but does not provide centralized, application-aware steering across diverse branch transport links.

A /22 contains 1,024 total addresses; subtracting the network and broadcast addresses leaves exactly 1,022 usable host addresses.

• A254 usable hosts corresponds to a /24, which has 256 total addresses, not the larger /22 block described in the scenario.
• C510 usable hosts matches a /23, which holds 512 total addresses, half the size of the /22 being allocated here.
• D2,046 usable hosts corresponds to a /21 with 2,048 total addresses, twice the size of the /22 in this allocation.

TCP 3389 is the default port for Microsoft's Remote Desktop Protocol, which delivers the graphical Windows desktop session described here.

• ATCP 23 is Telnet, an unencrypted text-based remote shell, not the graphical Windows remote desktop protocol the technician needs.
• BTCP 22 is SSH, used for secure command-line access, and does not carry the Microsoft remote desktop graphical session.
• DTCP 5900 is the default for VNC, a different remote desktop technology, not Microsoft's native Remote Desktop Protocol.

The AAAA record maps a hostname to a 128-bit IPv6 address, which is exactly the resolution IPv6-capable clients require here.

• BThe A record maps a hostname to a 32-bit IPv4 address, not the 128-bit IPv6 address the dual-stacked server needs published.
• CThe PTR record performs reverse lookups from an address back to a hostname, the opposite direction of the mapping required here.
• DThe SRV record advertises the host and port of a specific service, not a direct hostname-to-IPv6-address resolution.

A hub or repeater regenerates and repeats electrical signals across ports with no addressing, operating purely at the physical layer.

• AA data link device such as a switch reads MAC addresses to make forwarding decisions, but this device has no addressing awareness at all.
• BA network-layer device routes using IP addresses, whereas this device only repeats raw electrical signals with no logical addressing.
• CThe transport layer manages ports and end-to-end delivery, far above a device that merely regenerates and repeats electrical signals.

Leading zeros are dropped and the three consecutive all-zero groups collapse to a single double colon, giving the correct shortest form.

• AThis uses the double colon twice, which is invalid because a reader cannot tell how many zero groups each :: replaces.
• CThis wrongly shortens the ff00 group to ff, altering the actual address value rather than simply suppressing zeros.
• DTrimming 2001 down to 21 removes significant digits instead of only leading zeros, which changes the first hextet entirely.

A VPC is the tenant's logically isolated virtual network where it defines private IP ranges, subnets, and route tables within the provider.

• AAn availability zone is an isolated physical location within a region for fault tolerance, not a tenant's logically isolated IP-addressed network.
• BA region is a broad geographic area containing multiple data centers, not the per-tenant virtual network with custom subnets described here.
• DA CDN caches content at edge locations to reduce latency for users, not an isolated virtual network for defining private subnets.

The SFP+ form factor is designed to carry a single 10 Gigabit Ethernet lane, matching the one 10 Gbps uplink described here.

• BThe standard SFP form factor tops out at 1 Gigabit Ethernet, so it cannot deliver the required 10 Gbps on the uplink.
• CQSFP+ aggregates four 10 Gbps lanes into 40 Gigabit Ethernet, which exceeds and does not match a single 10 Gbps requirement.
• DThe legacy GBIC form factor supports Gigabit Ethernet at 1 Gbps, far below the 10 Gbps the new uplink requires.

A forward proxy retrieves web pages for internal clients, caches frequently requested content, and applies URL filtering, exactly matching this role.

• AA reverse proxy fronts internal servers to receive requests from outside clients, the opposite direction of mediating outbound employee browsing.
• BA load balancer distributes inbound connections across backend servers; it does not fetch, cache, and filter outbound client web requests.
• CA stateful firewall permits or denies traffic by connection state, but it does not fetch pages or cache content on the clients' behalf.

A DHCP server listens on UDP port 67 for client requests, while clients receive replies on UDP port 68.

• AUDP 53 is used by DNS for name resolution queries, not by a DHCP server receiving address lease requests from clients.
• CUDP 69 is used by TFTP for simple file transfers such as firmware images, not for DHCP lease assignment traffic.
• DUDP 123 is used by NTP to synchronize device clocks, which is unrelated to a DHCP server's address-leasing function.

NAT64 translates between IPv6 and IPv4, letting IPv6-only hosts communicate with an IPv4-only server that cannot be upgraded.

• ADual stack requires each host to run both IPv4 and IPv6 simultaneously, but the segment described is IPv6-only and cannot do that.
• BSLAAC lets IPv6 hosts autoconfigure their own addresses from a router advertisement; it performs no translation to IPv4 at all.
• DEUI-64 derives an IPv6 interface identifier from a MAC address; it builds an address but never translates between IP versions.